[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fiUx8qIc5YN0FuKXb65llEGuJEbGpNUzkTL5YPyWu27w":3},{"article":4,"iocs":46,"watch_terms":51,"solutions":52,"lesson":128},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"af4945ae-8268-47a6-9e1b-0cf956c93db5","Critical Fortinet2Shell Vulnerability Enables RCE Attacks in FortiClient with FortiPAM Enabled","critical-fortinet2shell-vulnerability-enables-rce-attacks-in-forticlient-with-fo-0d0b21","Fortinet has warned about a critical flaw in FortiClient that lets a remote attacker run code on a user’s computer. The attacker only needs the user to visit a malicious website. The bug is tracked as CVE-2026-121529 and carries a CVSS score of 9.1. Fortinet published the advisory on November 10, 2026. The flaw is […] The post Critical Fortinet2Shell Vulnerability Enables RCE Attacks in FortiClient with FortiPAM Enabled appeared first on Cyber Security News.","Fortinet has issued a warning about a critical vulnerability, CVE-2026-121529, in FortiClient that allows remote code execution on user machines with a CVSS score of 9.1. The flaw, identified as an origin validation error (CWE-346) due to a loose CORS misconfiguration, enables an attacker to send requests to a local service running on the victim's machine by having the user visit a malicious website. The vulnerability affects FortiClient on Mac and Windows, including PAM versions, with specific build ranges listed. The fix involves upgrading to patched versions, such as 7.4.8 or later for the 7.4 branch and 7.2.15 or later for the 7.2 branch. Indicators of a vulnerable setup on Windows include a service listening on TCP port 9191 or a running FortiVRS.exe process, though these do not confirm an attack.","Fortinet warns of critical FortiClient RCE flaw CVE-2026-121529, CVSS 9.1, affecting Mac and Windows.","https:\u002F\u002Fcybersecuritynews.com\u002Ffortinet2shell-vulnerability\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FCritical-Fortinet2Shell-Vulnerability-Enables-RCE-Attacks-in-FortiClient-with-FortiPAM-enabled.webp","2026-11-11T07:05:55+00:00","2026-11-11T08:00:25.247444+00:00",9,[17,20,22,25],{"name":18,"type":19},"FortiClient","product",{"name":21,"type":19},"FortiPAM",{"name":23,"type":24},"Fortinet","vendor",{"name":26,"type":27},"CORS","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,41],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47],{"type":48,"value":49,"context":50},"cve","CVE-2026-121529","Fortinet2Shell vulnerability identifier",[23,18,21],{"controls":53,"vendors":122},[54,83,108],{"slug":55,"name":56,"problem":57,"products":58},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":84,"name":85,"problem":86,"products":87},"patch-management","Automated patch management","Known holes get closed in days, not months.",[88,92,100],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":84,"product_name":89,"url":90,"description":91},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":109,"name":110,"problem":111,"products":112},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[113,114],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[123],{"slug":124,"name":23,"logo_path":125,"roles":126},"fortinet","\u002Fvendor-logos\u002Ffortinet.png",[127],"affected",{"slug":129,"title":130,"body":131,"framework_refs":132,"framework_notes":138},"forticlient-cors-misconfiguration-enables-remote-code-execution-via-malicious-websites","FortiClient CORS Misconfiguration Enables Remote Code Execution via Malicious Websites","A critical vulnerability (CVE-2026-121529) in FortiClient stems from an overly permissive CORS (Cross-Origin Resource Sharing) configuration, classified as an origin validation error (CWE-346). This misconfiguration allows a malicious website to send unauthorized requests to a local service running on TCP port 9191 on the victim's machine, triggering remote code execution without requiring direct network access. The flaw is especially dangerous because exploitation requires only that the user visit a malicious webpage — a low barrier for attackers. This incident highlights how insecure default or loose service configurations in security software can paradoxically become a critical attack surface. Organizations must treat local service configurations in endpoint security tools with the same rigor applied to internet-facing services.",[133,134,135,136,137],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A05:2021 Security Misconfiguration","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":139,"NIST SP 800-53 SI-2: Flaw Remediation":140,"OWASP A05:2021 Security Misconfiguration":141,"CIS Control 7: Continuous Vulnerability Management (v8)":142,"CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)":143},"NIS2 Article 21(2)(e) requires security in acquisition, development, and maintenance including vulnerability handling, meaning vendors and operators must address flaws like this CORS misconfiguration through defined disclosure and patching processes.","SI-2 requires organizations to identify, report, and correct information system flaws in a timely manner, which directly applies to the need for emergency patching of this critical FortiClient vulnerability.","OWASP A05 covers overly permissive configurations such as loose CORS policies, which is the precise root cause (CWE-346 origin validation error) that made this remote code execution possible.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities; a formal process would have ensured rapid patching of this CVSS 9.1 flaw across all FortiClient endpoints.","CIS Control 4 mandates that software be deployed with secure, validated configurations; enforcing strict CORS origin validation in FortiClient's local service would have prevented this misconfiguration-based attack."]